From 43e40a18477a31bd874e89cb9a3e5caf8007860d Mon Sep 17 00:00:00 2001
From: Jonathan Langevin <jon@langevin.me>
Date: Fri, 8 May 2026 06:16:34 -0400
Subject: [PATCH 1/4] ci: keep GoReleaser releases draft during upload

---
 .goreleaser.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a0d4d57..d7a6783 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -33,3 +33,6 @@ checksum:
 
 changelog:
   sort: asc
+
+release:
+  draft: true

From 093d125e68380d74ec21feeb34300b02c94be2ce Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Fri, 8 May 2026 06:24:46 -0400
Subject: [PATCH 2/4] ci: publish GoReleaser draft releases after upload

---
 .github/workflows/release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4e6065..3b178bc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,3 +53,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.REGISTRY_PAT }}
         continue-on-error: true
+      - name: Publish GitHub release
+        if: ${{ success() }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}"

From 9718e4df79998a56bf74c0394d515a7eb528c6bb Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Fri, 8 May 2026 10:08:14 -0400
Subject: [PATCH 3/4] ci: publish draft releases through GitHub API

---
 .github/workflows/release.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3b178bc..b3d522b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,18 @@ jobs:
           GH_TOKEN: ${{ secrets.REGISTRY_PAT }}
         continue-on-error: true
       - name: Publish GitHub release
-        if: ${{ success() }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}"
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.RELEASES_TOKEN || github.token }}
+          script: |
+            const tag = context.ref.replace('refs/tags/', '');
+            const { owner, repo } = context.repo;
+            const { data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag });
+            if (release.draft) {
+              await github.rest.repos.updateRelease({
+                owner,
+                repo,
+                release_id: release.id,
+                draft: false,
+              });
+            }

From d1deab81887f925ed81ae26a027f5e4c6b5486ea Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Fri, 8 May 2026 10:22:45 -0400
Subject: [PATCH 4/4] fix: address release publish review feedback

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3d522b..ceeeab1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,9 +56,9 @@ jobs:
       - name: Publish GitHub release
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.RELEASES_TOKEN || github.token }}
+          github-token: ${{ github.token }}
           script: |
-            const tag = context.ref.replace('refs/tags/', '');
+            const tag = process.env.GITHUB_REF_NAME;
             const { owner, repo } = context.repo;
             const { data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag });
             if (release.draft) {